1. Choose the HTTP method and URL
The method describes the intended operation. GET usually retrieves data, POST creates or triggers work, PUT or PATCH updates, and DELETE removes. The API documentation should tell you which method and endpoint to use.
2. Add parameters and headers
Query parameters refine the request through the URL. Headers carry metadata such as accepted response formats, content types and authorization. Check spelling carefully because header names and values can change server behavior.
3. Configure authentication
Depending on the API, use a Bearer token, Basic authentication or an API key. Never place production secrets into screenshots, public examples or issue reports.
4. Prepare the request body
Write endpoints may expect JSON, XML, raw text, form data or multipart uploads. Match the documented format and corresponding content type. When you already have a cURL example, import it instead of rebuilding it.
5. Read the response as evidence
Start with the HTTP status, but do not stop there. Inspect response headers, timing and returned data. A 200-level status may still carry an application-level error, while a 400-level response may explain exactly what needs to change.
6. Make the check repeatable
Move changing values such as base URLs into environments, organize related requests in collections and add response tests for the conditions that matter. Repeatable checks are more useful than screenshots because they can be run again after code changes.
A compact testing checklist
- Correct environment and hostname
- Expected HTTP method
- Required parameters and headers
- Valid, appropriately scoped credentials
- Correct request body format
- Expected status and response shape
- No secrets in saved examples or shared screenshots